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IN THE CLAIMS 

1-16. (canceled). 

17. (currently amended) An unauthorized- 
operation- judgment system for determining whether an 
operation received by a computer is an unauthorized 
operation, comprising: 

an operation-receiver for receiving that receives 
instruction data for executing said operation; 

a first prof ile- creator for creating that creates 
a first profile from said instruction data related to the 
operation for which instruction data was received by said 
computer; 

a first prof ile-storer for storing that stores 
said first profile that was created by said first profile- 
creator; 

a second profile-creator for identifying that 
identifies a user that executed said operation by said 
instruction data, and creating that creates a second 
profile related to the operation executed by said user; 
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a second prof ile-storer for storing that stores , 
according to user, said second profiles created by said 
second profile-creator; and 

a score-calculator for comparing that compares 
said instruction data with at least one profile that is 
stored in said first prof ile-storer or in said second 
prof ile-storer, and calculating that calculates a score for 
determining whether said operation is an unauthorized 
operation , wherein said score calculator compares said 
instruction data with said first profile when said 
instruction data is received while said computer is not 
logged into a user account, and wherein the score 
calculator compares said instruction data with at least 
said second profile corresponding to said user account when 
said instruction data is received while said computer is 
logged into said user account . 

18 . (previously presented) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a first log-data- storer for storing log data of 
said computer; and 

a second log-data-storer for storing log data 
according to a user of said computer; 
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wherein 

said first profile-creator references said first 
log-data- storer when creating said first profile; and 

said second profile-creator references said 
second log-data-storer when creating said second profile. 



19. (previously presented) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a login-detector for executing a process for 
detecting whether a certain user is logged into said 
computer; 

wherein when said login-detector detects that a 
certain user is logged in, said second profile-creator 
creates a second profile related to said user. 



20. (previously presented) The unauthorized- 
operation- judgment system of claim 19, wherein said login- 
detector executes detection processing at specified 
intervals while said computer is in operation. 



21. (previously presented) The unauthorized- 
operation- judgment system of claim 19, wherein when said 
login-detector does not detect that a certain user is 
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logged in even though detection processing is executed, 
said first profile-creator creates a first profile related 
to said computer. 

22. (previously presented) The unauthorized- 
operation- judgment system of claim 21, wherein said login- 
detector executes detection processing at specified 
intervals while said computer is in operation. 

23 . (previously presented) The unauthorized- 
operation- judgment system of claim 17 further comprising: 

a third profile-creator for creating a third 
profile related to an operation executed by a user that is 
identified as a first-time user, when the user executing 
said operation by said instruction data is identified as a 
first- time user operating said computer for the first time; 
and 

a third prof ile-storer for storing third profiles 
that are created by said third profile-creator; 

wherein said score -calculator uses at least one 
profile that is stored in said third prof ile-storer instead 
of said second prof ile-storer to determine whether said 
operation is an unauthorized operation. 
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24 . (previously presented) The unauthorized- 
operation- judgment system of claim 23 further comprising: 

an operation-record-storer for storing, according 
to user, totals related to at least one of the following: 
number of logins to said computer, operation time that said 
computer has been operated, or number of days said computer 
has been operated; and 

a first-time-user- judgment mechanism for 
referencing said operation-record-storer, and determining 
that a user executing said operation is a first-time user 
using said computer for the first time when said totals do 
not satisfy preset reference values; and 

wherein 

said third profile-creator creates a third 
profile for an operation executed by a user that is 
determined to be a first-time user by said first- time-user- 
judgment mechanism; and 

said score-calculator uses at least one profile 
stored in said third prof ile-storer when said first-time- 
user- judgment mechanism determines that a user is a first- 
time user to determine whether said operation is an 
unauthorized operation. 
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25. (previously presented) The unauthorized- 
operation- judgment system of claim 17, wherein 

said score-calculator calculates a score by 
calculating a deviation between said instruction data and 
data that is stored in said profiles. 

26. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

an operation- stopper for executing a process for 
stopping said operation when said score value exceeds a 
reference value. 

27. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

a warning-process for executing a process for 
displaying a warning on an operation screen of said 
computer, or generating a warning alarm on said computer, 
when said score exceeds a reference value . 
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28. (previously presented) The unauthorized- 
operation- judgment system of claim 17, further comprising: 

a warning-notification-transmitter for sending a 
notification warning to an administration server operated 
by an administrator of said computer that there is a 
possibility of an unauthorized operation, when said score 
exceeds a reference value. 

29. (currently amended) An unauthorized- 
operation- judgment method for determining whether an 
operation received by a computer is an unauthorized 
operation, comprising: 

receiving, by said computer, instruction data to 
execute said operation; 

creating, by said computer, a first profile 
related to the operation for which instruction data was 
received by said computer , wherein the first profile 
includes operations not identified with users ; 

storing, by said computer, said first profile in 
a first profile-storage unit; 

identifying, by said computer, a user that 
executed said operation by said instruction data; 
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creating, by said computer, a second profile 
related to the operation executed by said user , wherein the 
second profile includes only operations identified with 
users ; 

storing, by said computer, said second profile in 
a second prof ile- storage unit; 

comparing, by said computer, said instruction 
data with at least one profile that is stored in said first 
profile storage unit or in said second profile storage unit 
with said first profile when said instruction data is 
received while said computer is not logged into a user 
account, and comparing said instruction data with at least 
said second profile corresponding to said user account when 
said instruction data is received while said computer is 
logged into said user account ; and 

calculating , by said computer, a score for 
determining whether said operation is an unauthorized 
operation. 

30. (canceled) 



31. (currently amended) An unauthorized- 
operation- judgment computer program stored on a computer 
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readable medium, for determining wherein the unauthorized- 
operation- judgment computer program, when executed, 
determines whether an operation received by a computer is 
an unauthorized operation, the unauthorized-operation- 
judgment computer program comprising: 

software that receives instruction data for 
executing said operation, creates a first profile related 
to the operation for which instruction data was received by 
said computer, and stores said first profile in a first 
profile-storage unit , wherein the operation includes power 
on of a computer ; 

software that identifies the user that executed 
said operation by said instruction data, creating creates a 
second profile related to the operation executed by said 
user and stores said second profile in a second profile- 
storage unit; and 

software that compares said instruction data with 
said first profile when said instruction data is received 
while said computer is not logged into a user account, that 
compares said instruction data with at least said second 
profile corresponding to said user account when said 
instruction data is received while said computer is logged 
into said user account at lcaot one profile that is stored 
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in oaid first profile otoragc unit or in said second 
profile storage unit , and that calculates a score for 
determining whether said operation is an unauthorized 
operation. 

32. (canceled) 

33. (new) The unauthorized-operation- judgment 
method of claim 29 further comprising executing a process 
for detecting whether a certain user is logged into said 
computer, wherein when a certain user is detected as being 
logged in to said computer, said creating of a second 
profile comprises creating said second profile related to 
said certain user. 

34. (new) The unauthorized-operation- judgment 
method of claim 33, wherein when a certain user is not 
detected as being logged in even though detection 
processing is executed, said creating of a first profile 
comprises creating said first profile related to said 
computer. 
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35. (new) The unauthorized- operation- judgment 
method of claim 34, wherein said detection processing is 
executed at specified intervals while said computer is in 
operation. 

36. (new) The unauthorized-operation- judgment 
computer program of claim 31 further comprising software 
that detects whether a certain user is logged into said 
computer, wherein when the certain user is detected as 
being logged into said computer, said software that creates 
a second profile creates said second profile related to 
said certain user. 

37. (new) The unauthorized-operation- judgment 
computer program of claim 36, wherein when a certain user 
is not detected as being logged in even though detection 
processing is executed, said software that creates a first 
profile creates said first profile related to said 
computer . 

38. (new) The unauthorized-operation- judgment 
computer program of claim 37, wherein said detection 
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software is executed at specified intervals while said 
computer is in operation. 
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